CVE-2026-65197: CWE-347 Improper verification of cryptographic signature in H3C HDM Family-A G5

H3C HDM Family-A G5 devices verify firmware RSA signatures against a public key stored in `/conf/public.pem`. This file is writable by authenticated Redfish clients with `firmware-update` privileges via the `UpdateService.UploadSignKey` action, which only validates the filename extension. This allows an attacker with sufficient privileges to replace the public key with their own, sign malicious firmware, and have it accepted by the device. The device lacks a hardware root-of-trust to detect such key substitution. The vulnerability affects versions up to and including 6.14.01 on Family-A G3/G5 builds with the Redfish/DRE update tree. HDM2 devices use a different update mechanism and are not affected.

An attacker with authenticated access and firmware-update privileges can replace the trusted public key used for firmware signature verification, enabling installation of malicious firmware that passes signature checks. This compromises the device's firmware integrity verification, potentially allowing unauthorized firmware modifications. The impact is limited by the requirement for authenticated access with specific privileges. There are no known exploits in the wild.

No official patch or fix is currently documented. Since the vulnerability requires authenticated access with firmware-update privileges, restrict and monitor such privileges carefully. Review and limit Redfish client access to trusted administrators only. Monitor vendor advisories for any future patches or official remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.